我对这方面比较菜！麻烦斑竹给举例说明一下操作！还有我上面列举的都可以删除吗？那么怎么恢复呢？我回头扫描一个hj得日志！到时候再请斑竹给看看

等待回复：）这方面很菜！所以啰嗦了点！：）

重装系统试试看!

stfd.t
suflsd.dll
nsdff.dll
stdd
stdup.dll
stdsver.dll
std
ntfrs32

删除

就是说我的wpa.dbl不能删除对吧！还有我不会用注册表，就是手动找到能删除吗？这么做管用吗？因为这几天我多少时间在家里，还不清楚怎么做能不能解决问题！我先这么操作看看！如果在弹出不同网站，我继续来问！还有我应该修复什么？

如果不熟悉注册表，请用hj扫一个log贴上来

好的！等我下班我回家用hj扫描一个上来！我目前先手动在windows里面找到那几个文件删除！当然前面操作和飞跃说的那样去做！然后我在用hj扫描一个上来！您在给看看！看看那些地方还需要删除或者修改的！谢谢

我按照斑竹的做法去做了！把该删的都删掉了！我分别用sreng和hj都扫描了一下！把结果发上来！有点长！请斑竹帮忙再看看恶意程序是不是清除掉了！是不是不再弹出不同网站了？以下是sreng报告：2005-11-22,18:14:34

System Repair Engineer 1.1.0.269
    Windows XP Professional Service Pack 1 - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <iDuba Personal FireWall><C:\KAV6\KAVPFW.EXE>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <load><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SoundMan><SOUNDMAN.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <KAVRun><c:\KAV6\KAVRun.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <Kulansyn><c:\KAV6\Kulansyn.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <KpopMon><c:\KAV6\KpopMon.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <iDuba Personal FireWall><C:\KAV6\KAVPFW.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <UserFaultCheck><%systemroot%\system32\dumprep 0 -u>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <Userinit><C:\WINDOWS\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><>

==================================
启动文件夹
[腾讯QQ]
  <C:\Documents and Settings\hy\「开始」菜单\程序\启动\腾讯QQ.lnk><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINDOWS\System32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart]
  <C:\WINDOWS\system32\ati2sgag.exe><N/A>
[Kingsoft AntiVirus Service / KAVSvc]
  <c:\KAV6\KAVSvc.EXE><kingsoft Antivirus>

==================================

浏览器加载项
[KAVIEHelper Class]
  <C:\Program Files\Kos\KOSIEBar.dll>
[QQBrowserHelperObject Class]
  <D:\Program Files\Tencent\QQ\QQIEHelper.dll>
[百度搜霸]
  <C:\WINDOWS\DOWNLO~1\BaiDuBar.dll>
[豪杰超级解霸V8]
  <C:\Herosoft\HeroV8\STHSDVD.EXE>
[金山卓越]
  <url:http://www.joyo.com>
[@shdoclc.dll,-866]
  <>
[QQ]
  <D:\Program Files\Tencent\QQ\QQ.EXE>
[QQIEFloatBarCfgCmd Class]
  <D:\Program Files\Tencent\QQ\QQIEHelper.dll>
[金山毒霸网站]
  <url:http://www.duba.net>
[在线查毒]
  <c:\KAV6\kavie.HTM>
[AxInputControl Class]
  <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL>
[Shockwave Flash Object]
  <C:\WINDOWS\System32\macromed\flash\Flash.ocx>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\QQ\AddPanel.htm>
[添加到QQ表情]
  <D:\Program Files\Tencent\QQ\AddEmotion.htm>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\QQ\SendMMS.htm>
[百度Flash搜索]
  <res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/FLASHSEARCH.HTM>
[百度mp3搜索]
  <res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUMP3.HTM>
[百度信息快递搜索]
  <res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIE.HTM>
[百度图片搜索]
  <res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIMG.HTM>
[百度搜索]
  <res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUSEARCH.HTM>
[百度新闻搜索]
  <res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUNEWS.HTM>
[豪杰超级解霸V8实时播放]
  <C:\Herosoft\HeroV8\MPURLGET.HTM>

==================================
正在运行的进程
[PID: 560][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 628][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 660][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [C:\WINDOWS\system32\Ati2evxx.dll]  <N/A><N/A>
[PID: 704][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 716][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 868][C:\WINDOWS\System32\Ati2evxx.exe]  <N/A><N/A>
[PID: 892][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 996][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1104][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1176][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1428][C:\WINDOWS\system32\Ati2evxx.exe]  <N/A><N/A>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1480][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [c:\KAV6\KAVEXT.DLL]  <Kingsoft Corp.><2002, 5, 24, 6>
    [C:\Herosoft\HeroV8\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\WINDOWS\DOWNLO~1\BaiDuBar.dll]  <N/A><2, 0, 0, 0>
[PID: 1508][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll]  <Windows (R) 2000 DDK provider><5.00.2195.1620>
[PID: 1652][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 1724][c:\KAV6\KAVSvc.EXE]  <kingsoft Antivirus><2003, 11, 12, 70>
    [c:\KAV6\SvcComm.dll]  <kingsoft Antivirus><2004, 7, 28, 1>
    [c:\KAV6\SvcTimer.DLL]  <Kingsoft><2004.4.29.79>
    [c:\KAV6\KavComm.dll]  <Kingsoft Corporation><2003, 11, 12, 66>
    [c:\KAV6\RpcBrge.DLL]  <kingsoft><2003, 11, 12, 64>
    [c:\KAV6\KWatchFn2.dll]  <kingsoft Corporation><2004, 8, 24, 25>
    [c:\KAV6\KAEPlat.DLL]  <Kingsoft Corp.><2004, 8, 18, 48>
    [c:\KAV6\KAEMem.DAT]  <Kingsoft><2004, 8, 18, 10>
    [c:\KAV6\KAVUtils.dll]  <Kingsoft Corp><2004, 2, 12, 69>
    [c:\KAV6\KAVDlg.DLL]  <><2004.7.20.81>
    [c:\KAV6\KAVLogFn.dll]  <N/A><2003, 11, 26, 16>
[PID: 236][C:\WINDOWS\SOUNDMAN.EXE]  <Realtek Semiconductor Corp.><5.1.0.27>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 252][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe]  <ATI Technologies, Inc.><6.14.10.5090>
    [C:\Program Files\ATI Technologies\ATI Control

Panel\atipdsxx.dll]  <ATI Technologies, Inc.><6.14.10.5090>
    [C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS]  <ATI Technologies, Inc.><6.14.10.5090>
    [C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll]  <ATI Technologies, Inc.><6.14.10.5090>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 264][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  <RealNetworks, Inc.><0.1.0.3018>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 332][C:\KAV6\KpopMon.EXE]  <N/A><2004, 2, 2, 31>
    [C:\KAV6\KAVMLM.DLL]  <Kingsoft Corporation><2003.11.12.10>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 340][c:\KAV6\KWatchUI.EXE]  <><2004.1.6.119>
    [c:\KAV6\kavcomm.dll]  <Kingsoft Corporation><2003, 11, 12, 66>
    [c:\KAV6\kavdlg.dll]  <><2004.7.20.81>
    [c:\KAV6\KAVMLM.DLL]  <Kingsoft Corporation><2003.11.12.10>
    [c:\KAV6\RpcBrge.DLL]  <kingsoft><2003, 11, 12, 64>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 364][C:\KAV6\KAVPFW.EXE]  <Kingsoft Corporation><2004, 8, 16, 295>
    [C:\KAV6\KAVMLM.DLL]  <Kingsoft Corporation><2003.11.12.10>
    [C:\KAV6\PFWScanC.dll]  <KingSoft><2002, 4, 12, 3>
    [C:\KAV6\KAMsgBox.dll]  <><2002.9.27.30>
    [C:\KAV6\NetShare.dll]  <Kingsoft Antivirus><2004, 2, 20, 67>
    [C:\KAV6\KAEPlat.DLL]  <Kingsoft Corp.><2004, 8, 18, 48>
    [C:\KAV6\KAEMem.DAT]  <Kingsoft><2004, 8, 18, 10>
    [C:\KAV6\KAEQSCAN.DLL]  <Kingsoft Corp><2004, 3, 26, 69>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [C:\KAV6\KAVLogFn.dll]  <N/A><2003, 11, 26, 16>
[PID: 376][C:\WINDOWS\System32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1252][c:\KAV6\MailMon.EXE]  <Kingsoft Co., Ltd><2004, 2, 6, 245>
    [c:\KAV6\KMFilter.DLL]  <N/A><2004, 3, 1, 37>
    [c:\KAV6\parse822.dll]  <Quiksoft Corporation><2, 0, 0, 9>
    [c:\KAV6\KAVLogFn.dll]  <N/A><2003, 11, 26, 16>
    [c:\KAV6\KAVMLM.DLL]  <Kingsoft Corporation><2003.11.12.10>
    [c:\KAV6\KAMsgBox.DLL]  <><2002.9.27.30>
    [c:\KAV6\KAVComm.dll]  <Kingsoft Corporation><2003, 11, 12, 66>
    [c:\KAV6\RpcBrge.DLL]  <kingsoft><2003, 11, 12, 64>
    [c:\KAV6\KAVIPC.DLL]  <Kingsoft Corp.><2002, 3, 29, 8>
    [c:\KAV6\KAVDlg.DLL]  <><2004.7.20.81>
    [c:\KAV6\KAECall.DLL]  <Kingsoft Corporation><2003, 11, 14, 66>
    [c:\KAV6\KAEScan.DLL]  <Kingsoft Corp.><2003, 5, 24, 36>
    [c:\KAV6\KAEPlat.DLL]  <Kingsoft Corp.><2004, 8, 18, 48>
    [c:\KAV6\KAEMem.DAT]  <Kingsoft><2004, 8, 18, 10>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1128][c:\KAV6\KAVPlus.EXE]  <N/A><2004, 3, 3, 71>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 404][C:\WINDOWS\NOTEPAD.EXE]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 444][D:\Program Files\IEscan.exe]  <N/A><N/A>
    [C:\DOCUME~1\hy\LOCALS~1\Temp\E_80003\krnln.fnr]  <N/A><1, 0, 0, 1>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [C:\DOCUME~1\hy\LOCALS~1\Temp\E_80003\iext.fnr]  <N/A><1, 0, 0, 1>
    [C:\DOCUME~1\hy\LOCALS~1\Temp\E_80003\iext2.fne]  <N/A><1, 0, 0, 1>
[PID: 1716][D:\SREng.exe]  <Smallfrogs Studio><1.1.0.269>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>

==================================
文件关联
.TXT  Error. [NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [C:\WINDOWS\System32\winhlp32.exe %1]
.INI  Error. [notepad.exe %1]
.INF  OK. [C:\WINDOWS\System32\NOTEPAD.EXE %1]

==================================